Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Droot Internals
Search
Yuuki Tsubouchi (yuuk1)
April 23, 2016
Technology
3
20k
Droot Internals
id:y_uuki
第9回 コンテナ型仮想化の情報交換会@福岡
Yuuki Tsubouchi (yuuk1)
April 23, 2016
Tweet
Share
More Decks by Yuuki Tsubouchi (yuuk1)
See All by Yuuki Tsubouchi (yuuk1)
とあるSREの博士「過程」 / A Certain SRE’s Ph.D. Journey
yuukit
7
3.6k
eBPFを用いたAIネットワーク監視システム論文の実装 / eBPF Japan Meetup #4
yuukit
3
930
クラウドのテレメトリーシステム研究動向2025年
yuukit
3
990
博士論文公聴会: Scaling Telemetry Workloads in Cloud Applications: Techniques for Instrumentation, Storage, and Mining / PhD Defence
yuukit
1
210
博士学位論文予備審査 / Scaling Telemetry Workloads in Cloud Applications: Techniques for Instrumentation, Storage, and Mining
yuukit
1
2k
MetricSifter:クラウドアプリケーションにおける故障箇所特定の効率化のための多変量時系列データの特徴量削減 / FIT 2024
yuukit
2
270
工学としてのSRE再訪 / Revisiting SRE as Engineering
yuukit
19
14k
Cloudless Computingの論文紹介
yuukit
2
570
#SRE論文紹介 Detection is Better Than Cure: A Cloud Incidents Perspective V. Ganatra et. al., ESEC/FSE’23
yuukit
3
2.1k
Other Decks in Technology
See All in Technology
Snowflake のアーキテクチャは本当に筋がよかったのか / Data Engineering Study #30
indigo13love
0
280
From Live Coding to Vibe Coding with Firebase Studio
firebasethailand
1
320
AI時代の知識創造 ─GeminiとSECIモデルで読み解く “暗黙知”と創造の境界線
nyagasan
0
160
Shadow DOMとセキュリティ - 光と影の境界を探る / Shibuya.XSS techtalk #13
masatokinugawa
0
310
東京海上日動におけるセキュアな開発プロセスの取り組み
miyabit
0
200
今日からあなたもGeminiを好きになる
subaruhello
1
660
Kiro Hookを Terraformで検証
ao_inoue
0
140
手動からの解放!!Strands Agents で実現する総合テスト自動化
ideaws
3
390
2025-07-25 NOT A HOTEL TECH TALK ━ スマートホーム開発の最前線 ━ SOFTWARE
wakinchan
0
170
Tiptapで実現する堅牢で柔軟なエディター開発
kirik
1
150
[MIRU2025]Preference Optimization for Multimodal Large Language Models for Image Captioning Tasks
keio_smilab
PRO
0
100
公開初日に個人環境で試した Gemini CLI 体験記など / Gemini CLI実験レポート
you
PRO
3
620
Featured
See All Featured
Unsuck your backbone
ammeep
671
58k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
18
1k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
44
2.4k
Statistics for Hackers
jakevdp
799
220k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.9k
Optimizing for Happiness
mojombo
379
70k
Building Flexible Design Systems
yeseniaperezcruz
328
39k
A designer walks into a library…
pauljervisheath
207
24k
Building Adaptive Systems
keathley
43
2.7k
The Straight Up "How To Draw Better" Workshop
denniskardys
235
140k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
26
2.9k
Transcript
%SPPU*OUFSOBMT JEZ@VVLJ ୈ̕ճίϯςφܕԾԽͷใަձ!Ԭ
id:y_uuki @y_uuk1 ͯͳ!ژ ΣϒΦϖϨʔγϣϯΤϯδχΞ
IUUQZVVLJIBUFOBCMPHDPNFOUSZESPPU
TL;DR • ιϑτΣΞґଘࠈͷղܾͷͨΊʹ DockerΛ͍͍ͨ • ຊ൪ڥͰDockerΛӡ༻͢ΔͷͭΒ͍ • ʮBuild, Ship, Runʯͱ͍͏ίϯηϓτ͖
• DockerΠϝʔδΛS3Λܦ༝ͯ͠͠ɺ chrootͰ࣮ߦ͢Δख๏ͷఏҊ
ԾԽٕज़ )8ԾԽ 04ԾԽ ,7. 9FO ʜ γεςϜίϯςφ -9$ ΞϓϦέʔγϣϯ ίϯςφ
%PDLFS
ͳͥ()DockerΛ͏ͷ͔ • ✘ VMΑΓߴ • ✘ Πϛϡʔλϒϧ • ✘ Φʔτεέʔϧ
• ˚ ϙʔλϏϦςΟ • ◦ ϓϩάϥϚϒϧͳϗετڥ • ◦ ιϑτΣΞґଘࠈͷղܾ
ιϑτΣΞґଘࠈ • ͋ΔιϑτΣΞ͍͍ͨͯෳͷιϑτ ΣΞʹґଘ͢Δ • ґଘઌͷιϑτΣΞ·ͨෳͷιϑτ ΣΞʹґଘ͢Δ • ಉ͡ڥΛ࠶ݱ͢Δͷ͕͍͠ •
BundlerͳͲΛͬͯCͷϥΠϒϥϦʹ ґଘ͢Δ͜ͱ
Docker • LinuxͷσΟετϦϏϡʔγϣϯڥ ͝ͱݻΊͯΠϝʔδԽ • /lib, /usr/bin, /etcͳͲͥΜͿ • Linux
NamespacesͰಠཱͨ͠ڥΛ ࡞ͬͯΠϝʔδΛల։
DockerࠔΔ͜ͱ • Docker Engineͷෆ҆ఆ͞ • ωοτϫʔΫ·ΘΓͷύϑΥʔϚϯεྼԽ • ίϯςφͷΰϛআ • ίϯςφͷແఀࢭσϓϩΠ
• ίϯςφͷϩάཧ • ίϯςφͷࢹ • ίϯςφͷσόοά • Docker Registryͷӡ༻
chroot
chroot ☓ Docker ͷΞΠσΞ EPDLFSQVMMNZTRM $0/5"*/&3@*% EPDLFSDSFBUFNZTRM EPDLFSFYQPSU$0/5"*/&3@*%PNZTRMUBS NZTRMUBSΛ.Z42-Λಈ͔͍ͨ͠ϗετίϐʔ
͢Δɻ UBSYG[WBSDPOUBJOFSTNZTRMNZTRMUBS TVEPDISPPUWBSDPOUBJOFSTNZTRMNZTRME
None
࠷ۙͷΞϓϦέʔγϣϯσϓϩΠ • git pull͕͍ • σϓϩΠαʔό͔Βͷrsync͍ • tarball σϓϩΠ •
ՌΛS3ͳͲʹஔ͠ɺσϓϩΠઌͰ s3 cp Ͱμϯϩʔυͯ͠ల։ • Serf/Consul • σϓϩΠαʔό͔ΒͷSSH͕͍ͨΊ
Droot
#VJME 4IJQ 3VO ESPPUSVO EPDLFSCVJME ESPPUFYQPSU EPDLFS EBFNPO 4UPSBHF 4
ESPPUEFQMPZ BXTTDQ BXTTDQ
%PDLFS %SPPU #VJME EPDLFSCVJME EPDLFSCVJME 3FHJTUSZ %PDLFS)VC %JTUSJCVUJPO ͳΜͰΑ͍ "NB[PO4
'JMF'PSNBU %PDLFSJNBHF ͳΜͰΑ͍ FYUBSH[ $POUBJOFS -JOVY /BNFTQBDFT DISPPU
$ droot export • DockerΠϝʔδͷϑΝΠϧγεςϜΛtarܗࣜͰग़ྗ • جຊ docker create &&
docker export • gzip / aws cli ͱͷύΠϓʹΑΓɺtar.gzԽͯ͠S3ʹஔ • ϑΝΠϧγεςϜʹdrootઐ༻ͷڥมϑΝΠϧ (/.drootenv) ΛࠐΉ ESPPUFYQPSUEPDLFSpMFTBQQcH[JQDR cBXTTDQTCVDLFUBQQUBSH[
$ droot deploy • ඪ४ೖྗ͔ΒtarΞʔΧΠϒΛಡΈࠐΈɺࢦఆ͠ ͨσΟϨΫτϦʹల։ • සൟʹߋ৽͞ΕΔίϯςφͷσϓϩΠΛఆ • rsync
mode ͱ symlink mode BXTTDQTCVDLFUBQQUBSH[c HVO[JQDRcESPPUEFQMPZSPPUWBSDPOUBJOFST
symlink ʹΑΔ atomic deploy • σϓϩΠࡁΈͷίϯςφ ڥΛࠩ͠ସ͑Δඞཁ͕͋Δ • https://gist.github.com/ datagrok/3807742#file-
symlink-replacement-md • symlink Λ rename(2)ɹ (mv -T) ͰΓସ͑Δ͜ͱ ʹΑΓΞτϛοΫʹσΟϨ ΫτϦΛࠩ͠ସ͑Δ ᵓᴷᴷBQQBQQENBJO ᵓᴷᴷBQQE ᵋᴷᴷNBJO ᵋᴷᴷCJO ᵋᴷᴷCPPU ᵋᴷᴷEFW ᵋᴷᴷCBDLVQ ᵋᴷᴷCJO ᵋᴷᴷCPPU ᵋᴷᴷEFW
$ droot run • ࢦఆͨ͠σΟϨΫτϦΛchroot jailͱ࣮ͯ͠ߦ • σόΠεϑΝΠϧͷ࡞ (/dev/null, /dev/zeroͳͲ)
• ϗετͷ /etc/group, /etc/resolve.confͳͲΛίϐʔ • bind mountͰϗετଆͷҙͷσΟϨΫτϦΛϚϯτ • Linux capabilities(7) ͰݖݶΛ੍ TVEPESPPUSVODQCJOEWBSMPHSPPU ɹɹWBSDPOUBJOFSTBQQDPNNBOE
chroot(2) • ϓϩηεͷϧʔτσΟϨΫτϦΛมߋ • ϓϩηεͷઈରύεͷ୳ࡧىͷมߋͷΈ • ϓϩηεΛੜͨ͠Γ͠ͳ͍ • ΧϨϯτσΟϨΫτϦͦͷ··ͳͷͰcrhootίʔ ϧޙʹchdir(“/“)͢Δ͜ͱ͕ଟ͍
• jailڥ֎ͷϑΝΠϧషΒΕͨγϯϘϦοΫϦϯ ΫΞΫηεͰ͖ͳ͍
BindϚϯτ • Linux 2.2͔Βಋೖ • σΟϨΫτϦϑΝΠϧΛଞͷҐஔϚϯτ • chroot jailڥ͔ΒϚϯτઌͷϑΝΠϧσΟϨ ΫτϦΞΫηεͰ͖Δ
• /var/containers/app/var/log ͱ͔ࢀর͢Δͷ໘ • mount -o bind /var/log /var/containers/app/var/log • ϗετͷ /var/log Λڞ༗
LinuxέʔύϏϦςΟ • chroot(2)ಛݖϓϩηεͰͳ͍ͱίʔϧͰ͖ͳ͍ • (ݫີʹCAP_SYS_CHROOT) • ͔͠͠ɺεʔύʔϢʔβͰಈ͔͢ͷෆ҆ • εʔύʔϢʔβͰಈ͔ͭͭ͠ɺcapabilities(7)Ͱඞཁͳ ݖݶҎ֎Λམͱ͓ͯ͘͠
• CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_SETGID, CAP_SETUID, CAP_NET_BIND_SERVICE ΛڐՄ
Problems
• Docker (NamespacesΛͬͨίϯςφ)΄Ͳͷɹ ϙʔλϏϦςΟͳ͍ • Dockerίϯςφͷڥม͕Ҿ͖ܧ͕Εͳ͍ • Dockerίϯςφ্ͷ user/group ͕σϓϩΠઌ
ϗετʹ͍ͳ͍ ϙʔλϏϦςΟͷ
• ڥมϑΝΠϧͱͯ͠ӬଓԽ͞Εͳ͍ͷͰɺ Ұ୴ϑΝΠϧʹอଘ • droot export ͰҰ୴Dockerίϯςφͱͯ͠ىಈ͞ ͔ͤͯΒ env ίϚϯυͷ࣮ߦ݁ՌΛ
/.drootenv ͱ ͯ͠อଘ • droot run Ͱ /.drootnenv ΛಡΈͩͯ͠ڥมΛ ෮ݩ • droot run —env ͰڥมͷՃɾ্ॻ͖Մೳ ڥมͷҾ͖ܧ͗
• User NamespacesͰ/etc/groupͳͲΛΈͯඞཁ ͳuser/grpupΛࣗಈ࡞ • ϓϩηεπϦʔߏΛ͔͑ͨ͘ͳ͍ͷͰɺclone(2) Ͱͳ͘ chroot(2) ޙʹ unshare(2)
͢Δ • clone(2) ͩͱࢠϓϩηεΛੜ͢ΔͨΊɺεʔ ύʔόΠβϓϩηεͷԼͰdroot runͨ͠ͱ͖ ʹɺγάφϧཧ͕͏·͍͔͘ͳ͍͔ user/groupͷࣗಈ࡞(ະ࣮)
• ͜Ε͓ͦΒ͘ PID Namespacesͷ • https://lwn.net/Articles/532748/ • NamespacesԼͷϓϩηε͕pid 1ͱͯ͠ৼΔ͏ඞཁ͕Ͱ ͯ͘Δ
• orphanϓϩηεͷճऩ͢Δඞཁ͕͋Δ
ίϯςφ ࣗͰ࡞ΕΔ
(PMBOH
• github.com/docker/docker/pkg • archive, devicemapper, fileutils, mount, symlink… • github.com/opencontainers/runc/libcontainer
• Linux Namespaces·ΘΓ • https://github.com/syndtr/gocapability • LinuxέʔύϏϦςΟ • github.com/docker/engine-api • Docker APIΫϥΠΞϯτ ίϯςφπʔϧ͚ύοέʔδ
• ࣗ࡞ͷίϯςφπʔϧ Drootͷഎܠͱ࣮ • Build, Ship, RunΛ࣮ݱ͢Δୈ̏ͷιϑτΣΞ • droot export,
droot deploy, droot run • DockerͰΠϝʔδΛ࡞ͬͯ chroot Ͱ࣮ߦ • ϙʔλϏϦςΟͷͱͦͷղܾ • ίϯςφࣗͰ࡞ΕΔ ·ͱΊ
github.com/yuuki/droot